import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose'
import { HydratedDocument } from 'mongoose'

export type OcisCredentialDocument = HydratedDocument<OcisCredential>

// Persisted OIDC refresh token for the OCIS service user (svc-platform-api).
// OCIS has no backend service-account grant and trusts a single issuer, so we
// obtain a token via a one-time interactive OIDC login of the service user
// against the ocis provider, then keep minting access tokens with the
// refresh_token grant. Authentik ROTATES refresh tokens on every use, so the
// newest one must be persisted each time — that's the whole reason this lives
// in Mongo rather than memory/env. Single-row, keyed by `key`.
@Schema({ collection: 'ocis_credentials', timestamps: true })
export class OcisCredential {
  @Prop({ required: true, unique: true, index: true, default: 'ocis-svc' })
  key!: string

  @Prop({ required: true })
  refreshToken!: string
}

export const OcisCredentialSchema = SchemaFactory.createForClass(OcisCredential)
